Loading threat actor…
UAT-9686 is a China-linked advanced persistent threat actor associated with espionage-oriented compromises of Cisco email security appliances. Its observed activity dates to at least late November 2025. The group exploited CVE-2025-20393, an AsyncOS zero-day affecting Cisco Secure Email Gateway and Secure Email and Web Manager, to execute unauthenticated commands with root privileges. Targets included appliances with the Spam Quarantine feature enabled and exposed to the internet. Cisco Talos assesses the actor's Chinese nexus with moderate confidence; a specific government affiliation has not been established. The group's toolkit includes AquaShell, a lightweight Python backdoor that provides persistence and executes encoded shell commands received through unauthenticated HTTP POST requests. UAT-9686 also deploys AquaTunnel, a Go-based ReverseSSH variant, and Chisel to establish reverse tunnels, proxy traffic, and support internal network pivoting. AquaPurge removes selected entries from appliance logs to conceal intrusion activity. Its tooling and techniques overlap with those associated with APT41 and UNC5174, but these groups are not established aliases of UAT-9686. Confirmed victim countries and industry sectors have not been publicly established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
5 malware families Mallory has associated with this actor across public reporting.
1 CVE Mallory has associated with this actor across public reporting. 1 of them is exploited in the wild (not necessarily by this actor).
11 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.